@sayknow-cli/coding-agent 0.3.12 → 0.3.15

package/src/notifications/lifecycle-control-runtime.ts

@@ -8,19 +8,39 @@
  */
 import * as crypto from "node:crypto";
 import * as fs from "node:fs";
+import * as fsPromises from "node:fs/promises";
 import * as path from "node:path";
-
+import { tmuxRuntimeSessionPath } from "../skc-runtime/session-layout";
+import {
+	SKC_COORDINATOR_SESSION_ID_ENV,
+	SKC_COORDINATOR_SESSION_STATE_FILE_ENV,
+	SKC_TMUX_OWNER_GENERATION_ENV,
+	SKC_TMUX_OWNER_SERVER_KEY_ENV,
+	SKC_TMUX_OWNER_STATE_DIR_ENV,
+} from "../skc-runtime/session-state-sidecar";
 import {
-	buildSkcTmuxExactOptionTarget,
 	buildSkcTmuxProfileCommands,
+	buildSkcTmuxSessionSlug,
+	resolveSkcTmuxBinary,
 	resolveSkcTmuxCommand,
 } from "../skc-runtime/tmux-common";
+import {
+	captureOwnerGenerationBaseline,
+	classifyCgroup,
+	isExactScopedBootstrapSuccessReceipt,
+	type OwnerGenerationBaseline,
+	type OwnerIsolationProbe,
+	planTmuxOwnerIsolation,
+	replaceOwnerGeneration,
+	type TmuxServerProof,
+} from "../skc-runtime/tmux-owner-isolation";
 import {
 	findSkcTmuxSessionByName,
 	forceCloseSkcTmuxSession,
 	listSkcTmuxSessions,
-	statusSkcTmuxSession,
+	type SkcTmuxSessionStatus,
 } from "../skc-runtime/tmux-sessions";
+
 import type { ResumeCandidate, SessionCreateFrame, SessionLifecycleRequest, SessionLifecycleResponse } from "./index";
 import { normalizeLifecyclePath } from "./lifecycle-commands";
 import {
@@ -28,6 +48,7 @@ import {
 	type CreateEffectResult,
 	handleLifecycleRequest,
 	type LedgerDoc,
+	type LedgerEntry,
 	type LedgerStore,
 	type LifecycleOutcome,
 	type OrchestratorDeps,
@@ -61,36 +82,132 @@ export type LifecycleControlServerFactory = (input: {
 }) => LifecycleControlServer;
 
 /** Atomic + fsynced file-backed idempotency ledger store. */
+function ledgerReadError(error: unknown): Error {
+	const errorCode = (error as NodeJS.ErrnoException | undefined)?.code;
+	const code = typeof errorCode === "string" ? errorCode : "invalid";
+	return new Error(`skc_lifecycle_ledger_read_failed:${code.slice(0, 32)}`);
+}
+
+function isLedgerDoc(value: unknown): value is LedgerDoc {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const doc = value as { version?: unknown; entries?: unknown };
+	if (doc.version !== 1 || !doc.entries || typeof doc.entries !== "object" || Array.isArray(doc.entries)) return false;
+	return Object.values(doc.entries).every(entry => {
+		if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
+		const candidate = entry as Partial<LedgerEntry>;
+		return (
+			typeof candidate.requestHash === "string" &&
+			(candidate.state === "in_progress" ||
+				candidate.state === "success" ||
+				candidate.state === "failure" ||
+				candidate.state === "terminal_uncertain") &&
+			typeof candidate.requestId === "string" &&
+			(candidate.verb === "session_create" ||
+				candidate.verb === "session_close" ||
+				candidate.verb === "session_resume") &&
+			typeof candidate.createdAt === "number" &&
+			typeof candidate.updatedAt === "number" &&
+			!!candidate.targetSummary &&
+			typeof candidate.targetSummary === "object" &&
+			!Array.isArray(candidate.targetSummary)
+		);
+	});
+}
+
+function isUnsupportedDirectorySyncError(error: unknown): boolean {
+	const code = (error as NodeJS.ErrnoException | undefined)?.code;
+	return code === "EINVAL" || code === "ENOTSUP" || code === "EOPNOTSUPP";
+}
+
+function recordDirectorySyncCompatibilityDiagnostic(): void {
+	try {
+		process.stderr.write("skc lifecycle ledger directory sync unsupported\n");
+	} catch {
+		// Compatibility diagnostics must not alter ledger durability semantics.
+	}
+}
+
+function fsyncLedgerParentDirectory(directory: string): void {
+	const dirFd = fs.openSync(directory, "r");
+	let syncFailure: unknown;
+	let closeFailure: unknown;
+	try {
+		fs.fsyncSync(dirFd);
+	} catch (error) {
+		if (isUnsupportedDirectorySyncError(error)) recordDirectorySyncCompatibilityDiagnostic();
+		else syncFailure = error;
+	} finally {
+		try {
+			fs.closeSync(dirFd);
+		} catch (error) {
+			closeFailure = error;
+		}
+	}
+	if (syncFailure !== undefined && closeFailure !== undefined)
+		throw new AggregateError([syncFailure, closeFailure], "ledger directory sync failed");
+	if (syncFailure !== undefined) throw syncFailure;
+	if (closeFailure !== undefined) throw closeFailure;
+}
+
 export function fileLedgerStore(idempotencyFile: string): LedgerStore {
 	return {
 		async read(): Promise<LedgerDoc> {
+			let contents: string;
 			try {
-				return JSON.parse(fs.readFileSync(idempotencyFile, "utf8")) as LedgerDoc;
-			} catch {
-				return { version: 1, entries: {} };
+				contents = fs.readFileSync(idempotencyFile, "utf8");
+			} catch (error) {
+				const code = (error as NodeJS.ErrnoException).code;
+				if (code === "ENOENT") return { version: 1, entries: {} };
+				throw ledgerReadError(error);
+			}
+			try {
+				const doc = JSON.parse(contents) as unknown;
+				if (!isLedgerDoc(doc)) throw new Error("invalid");
+				return doc;
+			} catch (error) {
+				throw ledgerReadError(error);
 			}
 		},
 		async write(doc: LedgerDoc): Promise<void> {
 			fs.mkdirSync(path.dirname(idempotencyFile), { recursive: true });
 			const tmp = `${idempotencyFile}.${process.pid}.${Date.now()}.tmp`;
-			const fd = fs.openSync(tmp, "w", 0o600);
-			fs.writeSync(fd, JSON.stringify(doc));
-			fs.fsyncSync(fd);
-			fs.closeSync(fd);
-			fs.renameSync(tmp, idempotencyFile);
-			// fsync the parent directory so the rename itself is durable across a
-			// crash / power loss (the temp-file fsync alone does not persist the
-			// directory entry).
+			let fd: number | undefined;
+			let writeFailure: unknown;
+			let closeFailure: unknown;
 			try {
-				const dirFd = fs.openSync(path.dirname(idempotencyFile), "r");
+				fd = fs.openSync(tmp, "w", 0o600);
+				const encodedDoc = Buffer.from(JSON.stringify(doc), "utf8");
+				let offset = 0;
+				while (offset < encodedDoc.length) {
+					const written = fs.writeSync(fd, encodedDoc, offset, encodedDoc.length - offset);
+					if (written === 0) throw new Error("Short write");
+					offset += written;
+				}
+				fs.fsyncSync(fd);
+			} catch (error) {
+				writeFailure = error;
+			} finally {
+				if (fd !== undefined) {
+					try {
+						fs.closeSync(fd);
+					} catch (error) {
+						closeFailure = error;
+					}
+				}
+			}
+			if (writeFailure !== undefined || closeFailure !== undefined) {
 				try {
-					fs.fsyncSync(dirFd);
-				} finally {
-					fs.closeSync(dirFd);
+					fs.unlinkSync(tmp);
+				} catch {
+					// The failed temporary file is never published.
 				}
-			} catch {
-				// Some platforms reject directory fsync; the rename is still atomic.
+				if (writeFailure !== undefined && closeFailure !== undefined)
+					throw new AggregateError([writeFailure, closeFailure], "ledger temporary write failed");
+				throw writeFailure ?? closeFailure;
 			}
+			fs.renameSync(tmp, idempotencyFile);
+			// The temp-file fsync does not persist the rename's directory entry.
+			fsyncLedgerParentDirectory(path.dirname(idempotencyFile));
 		},
 	};
 }
@@ -150,77 +267,598 @@ export function buildCreateArgv(
 	return { cwd, args: extraArgs };
 }
 
-/** Real daemon-safe tmux launcher: detached `tmux new-session -d` + SKC tags. */
-export function daemonSpawnCreate(env: NodeJS.ProcessEnv = process.env) {
+function isKnownNoServerDiagnostic(stderr: string): boolean {
+	const diagnostic = stderr.trim().toLowerCase();
+	return (
+		diagnostic.length > 0 &&
+		diagnostic.length <= 512 &&
+		/no server running|failed to connect to server|error connecting to/.test(diagnostic)
+	);
+}
+
+function lifecycleOwnerIsolationProbe(tmux: string, env: NodeJS.ProcessEnv): OwnerIsolationProbe {
+	return {
+		readCallerCgroup: async () =>
+			process.platform === "linux" ? await fsPromises.readFile("/proc/self/cgroup", "utf8").catch(() => null) : null,
+		probeServer: async (serverKey: string): Promise<TmuxServerProof> => {
+			const result = Bun.spawnSync([tmux, "-L", serverKey, "list-sessions", "-F", "#{pid}\t#{session_name}"], {
+				stdout: "pipe",
+				stderr: "pipe",
+				env,
+			});
+			const stderr = result.stderr.toString();
+			if (result.exitCode !== 0)
+				return isKnownNoServerDiagnostic(stderr) ? { state: "absent" } : { state: "unverifiable" };
+			const lines = result.stdout
+				.toString()
+				.split("\n")
+				.map(line => line.trim())
+				.filter(Boolean);
+			const [pidText] = lines[0]?.split("\t") ?? [];
+			const pid = Number(pidText);
+			const sessionNames = lines.map(line => line.split("\t")[1]).filter((name): name is string => Boolean(name));
+			if (!Number.isSafeInteger(pid) || pid <= 0) return { state: "unverifiable" };
+			if (process.platform !== "linux")
+				return {
+					state: "safe",
+					pid,
+					startTime: "not_applicable",
+					cgroup: { classification: "not_applicable" },
+					sessionNames,
+				};
+			const [cgroupText, stat] = await Promise.all([
+				fsPromises.readFile(`/proc/${pid}/cgroup`, "utf8").catch(() => null),
+				fsPromises.readFile(`/proc/${pid}/stat`, "utf8").catch(() => null),
+			]);
+			const cgroup = classifyCgroup({ platform: process.platform, cgroupText });
+			const startTime = stat
+				?.slice(stat.lastIndexOf(")") + 2)
+				.trim()
+				.split(/\s+/)[19];
+			if (!startTime) return { state: "unverifiable", pid, cgroup, sessionNames };
+			return {
+				state:
+					cgroup.classification === "safe"
+						? "safe"
+						: cgroup.classification === "unsafe_service"
+							? "unsafe"
+							: "unverifiable",
+				pid,
+				startTime,
+				cgroup,
+				sessionNames,
+			};
+		},
+	};
+}
+
+function lifecycleRuntimeStateFile(cwd: string, sessionId: string, tmuxSession: string): string {
+	return tmuxRuntimeSessionPath(cwd, sessionId, buildSkcTmuxSessionSlug(tmuxSession));
+}
+
+async function preflightLifecycleTmuxOwner(input: {
+	tmux: string;
+	env: NodeJS.ProcessEnv;
+	ownerIsolationProbe?: OwnerIsolationProbe;
+}): Promise<void> {
+	const probe = input.ownerIsolationProbe ?? lifecycleOwnerIsolationProbe(input.tmux, input.env);
+	let server: TmuxServerProof;
+	try {
+		server = await probe.probeServer("default");
+	} catch {
+		throw new Error("skc_lifecycle_owner_server_unverifiable");
+	}
+	if (server.state === "unsafe") throw new Error("skc_lifecycle_owner_server_unsafe");
+	if (server.state === "unverifiable") throw new Error("skc_lifecycle_owner_server_unverifiable");
+	if (
+		server.state === "safe" &&
+		(!server.pid || !server.startTime || (process.platform === "linux" && server.cgroup?.classification !== "safe"))
+	)
+		throw new Error("skc_lifecycle_owner_server_unverifiable");
+	if (server.state === "absent") {
+		try {
+			if (
+				classifyCgroup({ platform: process.platform, cgroupText: await probe.readCallerCgroup() })
+					.classification === "unverifiable"
+			)
+				throw new Error("skc_lifecycle_owner_server_unverifiable");
+		} catch (error) {
+			if (error instanceof Error && error.message === "skc_lifecycle_owner_server_unverifiable") throw error;
+			throw new Error("skc_lifecycle_owner_server_unverifiable");
+		}
+	}
+}
+
+interface LifecycleAttemptExecution {
+	attemptCreated: true;
+	serverKey: string;
+	serverPid?: number;
+	serverStartTime?: string;
+	nativeSessionId?: string;
+	attemptSession: string;
+}
+
+function nativeTmuxSessionIdFromSpawn(stdout: string): string | undefined {
+	const value = stdout.endsWith("\n") ? stdout.slice(0, -1) : stdout;
+	return !value.includes("\n") && !value.includes("\r") && /^\$\d+$/.test(value) ? value : undefined;
+}
+
+async function isLifecycleGenerationUnchanged(
+	stateDir: string,
+	sessionId: string,
+	previousBaseline: OwnerGenerationBaseline,
+): Promise<boolean> {
+	try {
+		return (
+			JSON.stringify(await captureOwnerGenerationBaseline(stateDir, sessionId)) === JSON.stringify(previousBaseline)
+		);
+	} catch {
+		return false;
+	}
+}
+
+async function executeLifecycleTmuxOwnerPlan(input: {
+	tmux: string;
+	env: NodeJS.ProcessEnv;
+	sessionId: string;
+	generation: string;
+	stateDir: string;
+	cwd: string;
+	argv: string[];
+	sessionName: string;
+	ownerIsolationProbe?: OwnerIsolationProbe;
+	prepareSpawn?: () => void;
+	onAttemptCreated?: (attempt: LifecycleAttemptExecution) => void;
+	previousBaseline: OwnerGenerationBaseline;
+}): Promise<LifecycleAttemptExecution> {
+	const probe = input.ownerIsolationProbe ?? lifecycleOwnerIsolationProbe(input.tmux, input.env);
+	await preflightLifecycleTmuxOwner(input);
+	if (!(await isLifecycleGenerationUnchanged(input.stateDir, input.sessionId, input.previousBaseline)))
+		throw new Error("skc_lifecycle_owner_generation_changed");
+	const plan = await planTmuxOwnerIsolation(
+		{
+			schema_version: 1,
+			op: "plan",
+			platform: process.platform,
+			session_id: input.sessionId,
+			owner_generation: input.generation,
+			baseline: input.previousBaseline,
+			cwd: input.cwd,
+			state_dir: input.stateDir,
+			socket_key: "default",
+			tmux_argv: input.argv,
+		},
+		probe,
+	);
+	if (!plan.ok) throw new Error(`skc_lifecycle_owner_${plan.code}`);
+	const preSpawnProof =
+		plan.execution.mode === "direct" && plan.server_state === "safe"
+			? await probe.probeServer(plan.execution.server_key)
+			: undefined;
+	if (
+		preSpawnProof &&
+		(preSpawnProof.state !== "safe" ||
+			!preSpawnProof.pid ||
+			!preSpawnProof.startTime ||
+			(process.platform === "linux" && preSpawnProof.cgroup?.classification !== "safe"))
+	)
+		throw new Error("skc_lifecycle_owner_server_unverifiable");
+	input.prepareSpawn?.();
+	if (!(await isLifecycleGenerationUnchanged(input.stateDir, input.sessionId, input.previousBaseline)))
+		throw new Error("skc_lifecycle_owner_generation_changed");
+	const created = Bun.spawnSync(plan.execution.argv, {
+		stdout: "pipe",
+		stderr: "pipe",
+		env: input.env,
+		...(plan.execution.mode === "scoped" ? { stdin: new TextEncoder().encode(plan.execution.stdin_line) } : {}),
+	});
+	const rawStdout = created.stdout.toString();
+	const rawScopedReceipt =
+		plan.execution.mode === "scoped" && isExactScopedBootstrapSuccessReceipt(rawStdout)
+			? (JSON.parse(rawStdout.endsWith("\n") ? rawStdout.slice(0, -1) : rawStdout) as {
+					native_session_id: string;
+					server_pid: number;
+					server_start_time: string;
+					session_name: string;
+				})
+			: undefined;
+	const scopedReceipt =
+		rawScopedReceipt?.session_name === plan.execution.attempt_session ? rawScopedReceipt : undefined;
+	const attempt: LifecycleAttemptExecution = {
+		attemptCreated: true,
+		serverKey: plan.execution.server_key,
+		nativeSessionId:
+			plan.execution.mode === "scoped" ? scopedReceipt?.native_session_id : nativeTmuxSessionIdFromSpawn(rawStdout),
+		attemptSession: plan.execution.attempt_session,
+		...(scopedReceipt
+			? { serverPid: scopedReceipt.server_pid, serverStartTime: scopedReceipt.server_start_time }
+			: preSpawnProof
+				? { serverPid: preSpawnProof.pid, serverStartTime: preSpawnProof.startTime }
+				: {}),
+	};
+	input.onAttemptCreated?.(attempt);
+	if (created.exitCode !== 0) {
+		if (!attempt.nativeSessionId || attempt.serverPid === undefined || attempt.serverStartTime === undefined)
+			throw new Error("skc_lifecycle_spawn_failed_cleanup_uncertain");
+		throw new Error("skc_lifecycle_spawn_failed");
+	}
+	if (!attempt.nativeSessionId) throw new Error("skc_lifecycle_spawn_failed_cleanup_uncertain");
+	const proof = await probe.probeServer(plan.execution.server_key);
+	if (
+		proof.state !== "safe" ||
+		!proof.pid ||
+		!proof.startTime ||
+		!proof.sessionNames?.includes(plan.execution.attempt_session) ||
+		(process.platform === "linux" && proof.cgroup?.classification !== "safe") ||
+		(preSpawnProof && (proof.pid !== preSpawnProof.pid || proof.startTime !== preSpawnProof.startTime)) ||
+		(scopedReceipt && (proof.pid !== scopedReceipt.server_pid || proof.startTime !== scopedReceipt.server_start_time))
+	)
+		throw new Error("skc_lifecycle_owner_server_unverifiable");
+	attempt.serverPid = proof.pid;
+	attempt.serverStartTime = proof.startTime;
+	if (
+		!(await reproveLifecycleAttempt({
+			tmux: input.tmux,
+			env: input.env,
+			serverKey: attempt.serverKey,
+			nativeSessionId: attempt.nativeSessionId,
+			attemptSession: attempt.attemptSession,
+			expectedServerPid: attempt.serverPid,
+			expectedServerStartTime: attempt.serverStartTime,
+			ownerIsolationProbe: input.ownerIsolationProbe,
+		}))
+	)
+		throw new Error("skc_lifecycle_owner_server_unverifiable");
+
+	if (!(await isLifecycleGenerationUnchanged(input.stateDir, input.sessionId, input.previousBaseline)))
+		throw new Error("skc_lifecycle_owner_generation_changed");
+	return attempt;
+}
+
+function hasExactNativeSessionBinding(input: {
+	tmux: string;
+	env: NodeJS.ProcessEnv;
+	serverKey: string;
+	nativeSessionId: string;
+	attemptSession: string;
+}): boolean {
+	const result = Bun.spawnSync(
+		[
+			input.tmux,
+			"-L",
+			input.serverKey,
+			"display-message",
+			"-p",
+			"-t",
+			input.nativeSessionId,
+			"#{session_id}\t#{session_name}",
+		],
+		{ stdout: "pipe", stderr: "pipe", env: input.env },
+	);
+	if (result.exitCode !== 0) return false;
+	const output = result.stdout.toString();
+	const line = output.endsWith("\n") ? output.slice(0, -1) : output;
+	return line === `${input.nativeSessionId}\t${input.attemptSession}`;
+}
+
+function cleanupUncertain(): Error {
+	return new Error("skc_lifecycle_cleanup_uncertain");
+}
+
+async function reproveLifecycleAttempt(input: {
+	tmux: string;
+	env: NodeJS.ProcessEnv;
+	serverKey: string;
+	nativeSessionId: string;
+	attemptSession: string;
+	expectedServerPid: number;
+	expectedServerStartTime: string;
+	ownerIsolationProbe?: OwnerIsolationProbe;
+}): Promise<boolean> {
+	const probe = input.ownerIsolationProbe ?? lifecycleOwnerIsolationProbe(input.tmux, input.env);
+	const isExpectedServer = (proof: TmuxServerProof): boolean =>
+		proof.state === "safe" &&
+		proof.pid === input.expectedServerPid &&
+		proof.startTime === input.expectedServerStartTime &&
+		proof.sessionNames?.includes(input.attemptSession) === true &&
+		(process.platform !== "linux" || proof.cgroup?.classification === "safe");
+	let proof: TmuxServerProof;
+	try {
+		proof = await probe.probeServer(input.serverKey);
+	} catch {
+		return false;
+	}
+	if (!isExpectedServer(proof) || !hasExactNativeSessionBinding(input)) return false;
+	try {
+		proof = await probe.probeServer(input.serverKey);
+	} catch {
+		return false;
+	}
+	return isExpectedServer(proof);
+}
+
+async function cleanupLifecycleAttempt(input: {
+	tmux: string;
+	env: NodeJS.ProcessEnv;
+	serverKey: string;
+	nativeSessionId?: string;
+	attemptSession: string;
+	expectedServerPid?: number;
+	expectedServerStartTime?: string;
+	ownerIsolationProbe?: OwnerIsolationProbe;
+}): Promise<void> {
+	if (!input.nativeSessionId || input.expectedServerPid === undefined || input.expectedServerStartTime === undefined)
+		throw cleanupUncertain();
+	// External reproof narrows the window and detects obvious replacement before
+	// mutation, but the server evaluates the identity predicate atomically.
+	if (
+		!(await reproveLifecycleAttempt({
+			tmux: input.tmux,
+			env: input.env,
+			serverKey: input.serverKey,
+			nativeSessionId: input.nativeSessionId,
+			attemptSession: input.attemptSession,
+			expectedServerPid: input.expectedServerPid,
+			expectedServerStartTime: input.expectedServerStartTime,
+			ownerIsolationProbe: input.ownerIsolationProbe,
+		}))
+	)
+		throw cleanupUncertain();
+	const guarded = Bun.spawnSync(
+		[
+			input.tmux,
+			"-L",
+			input.serverKey,
+			"if-shell",
+			"-t",
+			input.nativeSessionId,
+			"-F",
+			lifecycleMetadataPredicate(input.expectedServerPid, input.nativeSessionId, input.attemptSession),
+			`kill-session -t '${input.nativeSessionId}' ; display-message -p __skc_lifecycle_cleanup_ok__`,
+			"display-message -p __skc_lifecycle_cleanup_refused__",
+		],
+		{ stdout: "pipe", stderr: "pipe", env: input.env },
+	);
+	if (guarded.exitCode !== 0 || guarded.stdout.toString().trim() !== "__skc_lifecycle_cleanup_ok__")
+		throw cleanupUncertain();
+}
+
+async function assertLifecycleTmuxServerSafe(input: {
+	tmux: string;
+	env: NodeJS.ProcessEnv;
+	ownerIsolationProbe?: OwnerIsolationProbe;
+}): Promise<void> {
+	const proof = await (input.ownerIsolationProbe ?? lifecycleOwnerIsolationProbe(input.tmux, input.env)).probeServer(
+		"default",
+	);
+	if (
+		proof.state !== "safe" ||
+		!proof.pid ||
+		!proof.startTime ||
+		(process.platform === "linux" && proof.cgroup?.classification !== "safe")
+	)
+		throw new Error(`skc_lifecycle_owner_${proof.state === "unsafe" ? "server_unsafe" : "server_unverifiable"}`);
+}
+
+/** Real daemon-safe tmux launcher: canonical owner-isolation plan + SKC tags. */
+export function daemonSpawnCreate(
+	env: NodeJS.ProcessEnv = process.env,
+	opts: { ownerIsolationProbe?: OwnerIsolationProbe } = {},
+) {
 	return async (
 		frame: SessionCreateFrame,
 		ids: { lifecycleRequestId: string; intendedSessionId: string; startupPromptRef?: string },
 	): Promise<CreateEffectResult> => {
-		const tmux = resolveSkcTmuxCommand(env);
+		const tmuxBinary = resolveSkcTmuxBinary({ env });
+		if (tmuxBinary.isPsmux) throw new Error("skc_lifecycle_psmux_unsupported");
+		const tmux = tmuxBinary.command;
 		const name = tmuxSessionNameFor(ids.intendedSessionId);
 		const { cwd, args } = buildCreateArgv(frame, ids);
-		// A `plain_dir` target is a NEW working directory: create it before spawn
-		// so `/session_create dir <newdir>` works as documented.
-		if (frame.target.kind === "plain_dir") {
-			fs.mkdirSync(cwd, { recursive: true });
-		}
-		// Detached: no interactive TTY needed (daemon-safe).
+		const sessionStateFile = lifecycleRuntimeStateFile(cwd, ids.intendedSessionId, name);
+		const stateDir = path.dirname(sessionStateFile);
+		const generation = crypto.randomUUID();
+		const previousBaseline = await captureOwnerGenerationBaseline(stateDir, ids.intendedSessionId);
+		// Detached: no interactive TTY needed (daemon-safe). These values contain
+		// only opaque ids and paths needed by the resident sidecar to publish its
+		// exact-owner terminal verdict.
 		const childEnv: Record<string, string> = {
 			SKC_TMUX_LAUNCHED: "1",
 			SKC_NOTIFICATIONS: "1",
 			SKC_SESSION_ID: ids.intendedSessionId,
 			SKC_LIFECYCLE_REQUEST_ID: ids.lifecycleRequestId,
+			[SKC_COORDINATOR_SESSION_ID_ENV]: ids.intendedSessionId,
+			[SKC_COORDINATOR_SESSION_STATE_FILE_ENV]: sessionStateFile,
+			[SKC_TMUX_OWNER_GENERATION_ENV]: generation,
+			[SKC_TMUX_OWNER_STATE_DIR_ENV]: stateDir,
+			[SKC_TMUX_OWNER_SERVER_KEY_ENV]: "default",
 		};
 		if (ids.startupPromptRef) childEnv.SKC_STARTUP_PROMPT_REF = ids.startupPromptRef;
 		const envPairs = Object.entries(childEnv)
 			.map(([k, v]) => `${k}=${shellQuote(v)}`)
 			.join(" ");
 		const command = `cd ${shellQuote(cwd)} && exec env ${envPairs} skc ${args.map(shellQuote).join(" ")}`;
-		const created = Bun.spawnSync([tmux, "new-session", "-d", "-s", name, "sh", "-c", command], {
-			stdout: "pipe",
-			stderr: "pipe",
-			env,
-		});
-		if (created.exitCode !== 0) {
-			throw new Error(created.stderr.toString().trim() || "skc_lifecycle_spawn_failed");
-		}
-		const target = buildSkcTmuxExactOptionTarget(name);
-		const metaCommands = buildSkcTmuxProfileCommands(target, env, {
-			sessionId: ids.intendedSessionId,
-			project: cwd,
-		});
-		for (const cmd of metaCommands) {
-			Bun.spawnSync([tmux, ...cmd.args], { stdout: "pipe", stderr: "pipe", env });
+		let ownerExecution: LifecycleAttemptExecution | undefined;
+		try {
+			ownerExecution = await executeLifecycleTmuxOwnerPlan({
+				tmux,
+				env,
+				sessionId: ids.intendedSessionId,
+				generation,
+				stateDir,
+				cwd,
+				sessionName: name,
+				argv: [tmux, "new-session", "-d", "-P", "-F", "#{session_id}", "-s", name, "sh", "-c", command],
+				ownerIsolationProbe: opts.ownerIsolationProbe,
+				onAttemptCreated: attempt => {
+					ownerExecution = attempt;
+				},
+				previousBaseline,
+
+				prepareSpawn: () => {
+					if (frame.target.kind === "plain_dir") fs.mkdirSync(cwd, { recursive: true });
+				},
+			});
+			if (!ownerExecution.nativeSessionId || ownerExecution.serverPid === undefined)
+				throw new Error("skc_lifecycle_owner_server_unverifiable");
+			const target = `${ownerExecution.nativeSessionId}:`;
+			await applyRequiredLifecycleTmuxMetadata(
+				tmux,
+				target,
+				env,
+				{
+					sessionId: ids.intendedSessionId,
+					sessionStateFile,
+					project: cwd,
+					ownerGeneration: generation,
+					ownerServerKey: ownerExecution.serverKey,
+				},
+				{
+					nativeSessionId: ownerExecution.nativeSessionId,
+					attemptSession: ownerExecution.attemptSession,
+					serverPid: ownerExecution.serverPid,
+				},
+			);
+			if (
+				!ownerExecution.nativeSessionId ||
+				ownerExecution.serverPid === undefined ||
+				ownerExecution.serverStartTime === undefined ||
+				!(await reproveLifecycleAttempt({
+					tmux,
+					env,
+					serverKey: ownerExecution.serverKey,
+					nativeSessionId: ownerExecution.nativeSessionId,
+					attemptSession: ownerExecution.attemptSession,
+					expectedServerPid: ownerExecution.serverPid,
+					expectedServerStartTime: ownerExecution.serverStartTime,
+					ownerIsolationProbe: opts.ownerIsolationProbe,
+				}))
+			)
+				throw new Error("skc_lifecycle_owner_server_unverifiable");
+			if (!(await isLifecycleGenerationUnchanged(stateDir, ids.intendedSessionId, previousBaseline)))
+				throw new Error("skc_lifecycle_owner_generation_changed");
+			await replaceOwnerGeneration(stateDir, ids.intendedSessionId, generation, previousBaseline);
+		} catch (error) {
+			let cleanupFailure: unknown;
+			if (ownerExecution?.attemptCreated) {
+				try {
+					await cleanupLifecycleAttempt({
+						tmux,
+						env,
+						serverKey: ownerExecution.serverKey,
+						nativeSessionId: ownerExecution.nativeSessionId,
+						attemptSession: ownerExecution.attemptSession,
+						expectedServerPid: ownerExecution.serverPid,
+						expectedServerStartTime: ownerExecution.serverStartTime,
+						ownerIsolationProbe: opts.ownerIsolationProbe,
+					});
+				} catch (cleanupError) {
+					cleanupFailure = cleanupError;
+				}
+			}
+			if (cleanupFailure !== undefined)
+				throw new AggregateError([error, cleanupFailure], "skc_lifecycle_cleanup_uncertain");
+			throw error;
 		}
-		const status = statusSkcTmuxSession(name, env);
+
 		return {
 			sessionId: ids.intendedSessionId,
 			tmuxSession: name,
-			sessionStateFile: status.sessionStateFile,
+			sessionStateFile,
 			endpointUrl: "",
 			topicThreadId: "",
 		};
 	};
 }
 
+function tmuxCommandArgument(value: string): string {
+	return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("$", "\\$").replaceAll("`", "\\`")}"`;
+}
+
+function lifecycleMetadataPredicate(expectedPid: number, nativeSessionId: string, attemptSession: string): string {
+	return `#{&&:#{==:#{pid},${expectedPid}},#{&&:#{==:#{session_id},${nativeSessionId}},#{==:#{session_name},${attemptSession}}}}`;
+}
+
+async function applyRequiredLifecycleTmuxMetadata(
+	tmux: string,
+	target: string,
+	env: NodeJS.ProcessEnv,
+	metadata: {
+		sessionId: string;
+		sessionStateFile: string;
+		project: string;
+		ownerGeneration: string;
+		ownerServerKey: string;
+	},
+	attempt: { nativeSessionId: string; attemptSession: string; serverPid: number },
+): Promise<void> {
+	if (
+		!metadata.sessionId.trim() ||
+		!metadata.sessionStateFile.trim() ||
+		!metadata.project.trim() ||
+		!metadata.ownerGeneration.trim() ||
+		!metadata.ownerServerKey.trim()
+	)
+		throw new Error("skc_lifecycle_metadata_required_missing");
+	const commands = buildSkcTmuxProfileCommands(target, env, metadata)
+		.map(command => command.args.map(tmuxCommandArgument).join(" "))
+		.join(" ; ");
+	const result = Bun.spawnSync(
+		[
+			tmux,
+			"-L",
+			metadata.ownerServerKey,
+			"if-shell",
+			"-t",
+			attempt.nativeSessionId,
+			"-F",
+			lifecycleMetadataPredicate(attempt.serverPid, attempt.nativeSessionId, attempt.attemptSession),
+			`${commands} ; display-message -p __skc_lifecycle_metadata_ok__`,
+			"display-message -p __skc_lifecycle_metadata_refused__",
+		],
+		{ stdout: "pipe", stderr: "pipe", env },
+	);
+	if (result.exitCode !== 0 || result.stdout.toString().trim() !== "__skc_lifecycle_metadata_ok__")
+		throw new Error("skc_lifecycle_metadata_write_failed");
+}
+
 /** Real force-close effect (SKC-managed only, id-matched). */
-export function daemonCloseSession(env: NodeJS.ProcessEnv = process.env) {
+export function daemonCloseSession(
+	env: NodeJS.ProcessEnv = process.env,
+	deps: {
+		forceClose?: (
+			name: string,
+			env: NodeJS.ProcessEnv,
+			expectedSessionId?: string,
+			sessionStateFile?: string,
+		) => Promise<void>;
+		findSession?: (name: string, env: NodeJS.ProcessEnv) => SkcTmuxSessionStatus | undefined;
+	} = {},
+) {
 	return async (target: { sessionId: string; tmuxSession?: string; sessionStateFile?: string }) => {
 		const name = target.tmuxSession ?? tmuxSessionNameFor(target.sessionId);
-		forceCloseSkcTmuxSession(name, env, target.sessionId, target.sessionStateFile);
-		return { processGone: findSkcTmuxSessionByName(name, env) === undefined };
+		await (deps.forceClose ?? forceCloseSkcTmuxSession)(name, env, target.sessionId, target.sessionStateFile);
+		return { processGone: (deps.findSession ?? findSkcTmuxSessionByName)(name, env) === undefined };
 	};
 }
 
 /** Real resume effect: reattach if a live SKC session matches; else resolve the
  *  prefix against saved history and fail closed (`ambiguous`/`notFound`) before
  *  cold-restarting exactly one resolved session via the daemon-safe launcher. */
-export function daemonResumeSession(env: NodeJS.ProcessEnv = process.env, opts: { sessionsRoot?: string } = {}) {
+export function daemonResumeSession(
+	env: NodeJS.ProcessEnv = process.env,
+	opts: {
+		sessionsRoot?: string;
+		listSessions?: (env: NodeJS.ProcessEnv) => SkcTmuxSessionStatus[];
+		ownerIsolationProbe?: OwnerIsolationProbe;
+	} = {},
+) {
 	return async (target: {
 		sessionIdOrPrefix: string;
 		path?: string;
 	}): Promise<ResumeEffectResult | { ambiguous: ResumeCandidate[] } | { notFound: true }> => {
-		const live = listSkcTmuxSessions(env).filter(
+		const tmuxBinary = resolveSkcTmuxBinary({ env });
+		if (tmuxBinary.isPsmux) throw new Error("skc_lifecycle_psmux_unsupported");
+		const live = (opts.listSessions?.(env) ?? listSkcTmuxSessions(env)).filter(
 			s => s.sessionId === target.sessionIdOrPrefix || s.sessionId?.startsWith(target.sessionIdOrPrefix),
 		);
 		if (live.length > 1) {
@@ -230,6 +868,11 @@ export function daemonResumeSession(env: NodeJS.ProcessEnv = process.env, opts:
 		}
 		if (live.length === 1) {
 			const s = live[0]!;
+			await assertLifecycleTmuxServerSafe({
+				tmux: resolveSkcTmuxCommand(env),
+				env,
+				ownerIsolationProbe: opts.ownerIsolationProbe,
+			});
 			return {
 				sessionId: s.sessionId ?? s.name,
 				tmuxSession: s.name,
@@ -261,26 +904,111 @@ export function daemonResumeSession(env: NodeJS.ProcessEnv = process.env, opts:
 		}
 		const resolvedResumeCwd = resumeCwd ? path.resolve(resumeCwd) : undefined;
 		const resumeCwdStat = resolvedResumeCwd ? fs.statSync(resolvedResumeCwd, { throwIfNoEntry: false }) : undefined;
-		if (!resumeCwdStat?.isDirectory()) {
+		if (typeof resolvedResumeCwd !== "string" || !resumeCwdStat?.isDirectory()) {
 			throw new Error(`skc_lifecycle_resume_cwd_unavailable: ${resolvedResumeCwd ?? "(missing)"}`);
 		}
-		const tmux = resolveSkcTmuxCommand(env);
+		const tmux = tmuxBinary.command;
 		const name = tmuxSessionNameFor(resumeId);
-		const cwdPrefix = resolvedResumeCwd ? `cd ${shellQuote(resolvedResumeCwd)} && ` : "";
-		const command = `${cwdPrefix}exec env SKC_TMUX_LAUNCHED=1 SKC_NOTIFICATIONS=1 skc --resume ${shellQuote(resumeId)}`;
-		const r = Bun.spawnSync([tmux, "new-session", "-d", "-s", name, "sh", "-c", command], {
-			stdout: "pipe",
-			stderr: "pipe",
-			env,
-		});
-		if (r.exitCode !== 0) throw new Error(r.stderr.toString().trim() || "skc_lifecycle_resume_failed");
-		const tgt = buildSkcTmuxExactOptionTarget(name);
-		for (const cmd of buildSkcTmuxProfileCommands(tgt, env, { sessionId: resumeId, project: resolvedResumeCwd })) {
-			Bun.spawnSync([tmux, ...cmd.args], { stdout: "pipe", stderr: "pipe", env });
+		const sessionStateFile = lifecycleRuntimeStateFile(resolvedResumeCwd, resumeId, name);
+		const stateDir = path.dirname(sessionStateFile);
+		const generation = crypto.randomUUID();
+		const previousBaseline = await captureOwnerGenerationBaseline(stateDir, resumeId);
+		const childEnv: Record<string, string> = {
+			SKC_TMUX_LAUNCHED: "1",
+			SKC_NOTIFICATIONS: "1",
+			[SKC_COORDINATOR_SESSION_ID_ENV]: resumeId,
+			[SKC_COORDINATOR_SESSION_STATE_FILE_ENV]: sessionStateFile,
+			[SKC_TMUX_OWNER_GENERATION_ENV]: generation,
+			[SKC_TMUX_OWNER_STATE_DIR_ENV]: stateDir,
+			[SKC_TMUX_OWNER_SERVER_KEY_ENV]: "default",
+		};
+		const envPairs = Object.entries(childEnv)
+			.map(([key, value]) => `${key}=${shellQuote(value)}`)
+			.join(" ");
+		const command = `cd ${shellQuote(resolvedResumeCwd)} && exec env ${envPairs} skc --resume ${shellQuote(resumeId)}`;
+		let ownerExecution: LifecycleAttemptExecution | undefined;
+		try {
+			ownerExecution = await executeLifecycleTmuxOwnerPlan({
+				tmux,
+				env,
+				sessionId: resumeId,
+				generation,
+				stateDir,
+				cwd: resolvedResumeCwd,
+				sessionName: name,
+				argv: [tmux, "new-session", "-d", "-P", "-F", "#{session_id}", "-s", name, "sh", "-c", command],
+				ownerIsolationProbe: opts.ownerIsolationProbe,
+				onAttemptCreated: attempt => {
+					ownerExecution = attempt;
+				},
+				previousBaseline,
+			});
+			if (!ownerExecution.nativeSessionId || ownerExecution.serverPid === undefined)
+				throw new Error("skc_lifecycle_owner_server_unverifiable");
+			const tgt = `${ownerExecution.nativeSessionId}:`;
+			await applyRequiredLifecycleTmuxMetadata(
+				tmux,
+				tgt,
+				env,
+				{
+					sessionId: resumeId,
+					sessionStateFile,
+					project: resolvedResumeCwd,
+					ownerGeneration: generation,
+					ownerServerKey: ownerExecution.serverKey,
+				},
+				{
+					nativeSessionId: ownerExecution.nativeSessionId,
+					attemptSession: ownerExecution.attemptSession,
+					serverPid: ownerExecution.serverPid,
+				},
+			);
+			if (
+				!ownerExecution.nativeSessionId ||
+				ownerExecution.serverPid === undefined ||
+				ownerExecution.serverStartTime === undefined ||
+				!(await reproveLifecycleAttempt({
+					tmux,
+					env,
+					serverKey: ownerExecution.serverKey,
+					nativeSessionId: ownerExecution.nativeSessionId,
+					attemptSession: ownerExecution.attemptSession,
+					expectedServerPid: ownerExecution.serverPid,
+					expectedServerStartTime: ownerExecution.serverStartTime,
+					ownerIsolationProbe: opts.ownerIsolationProbe,
+				}))
+			)
+				throw new Error("skc_lifecycle_owner_server_unverifiable");
+			if (!(await isLifecycleGenerationUnchanged(stateDir, resumeId, previousBaseline)))
+				throw new Error("skc_lifecycle_owner_generation_changed");
+			await replaceOwnerGeneration(stateDir, resumeId, generation, previousBaseline);
+		} catch (error) {
+			let cleanupFailure: unknown;
+			if (ownerExecution?.attemptCreated) {
+				try {
+					await cleanupLifecycleAttempt({
+						tmux,
+						env,
+						serverKey: ownerExecution.serverKey,
+						nativeSessionId: ownerExecution.nativeSessionId,
+						attemptSession: ownerExecution.attemptSession,
+						expectedServerPid: ownerExecution.serverPid,
+						expectedServerStartTime: ownerExecution.serverStartTime,
+						ownerIsolationProbe: opts.ownerIsolationProbe,
+					});
+				} catch (cleanupError) {
+					cleanupFailure = cleanupError;
+				}
+			}
+			if (cleanupFailure !== undefined)
+				throw new AggregateError([error, cleanupFailure], "skc_lifecycle_cleanup_uncertain");
+			throw error;
 		}
+
 		return {
 			sessionId: resumeId,
 			tmuxSession: name,
+			sessionStateFile,
 			endpointUrl: "",
 			topicThreadId: "",
 			mode: "cold_restarted",
@@ -343,6 +1071,113 @@ export function outcomeToResponse(frame: SessionLifecycleRequest, outcome: Lifec
 	};
 }
 
+const MAX_LIFECYCLE_REQUEST_ID_BYTES = 128;
+
+function hasLoneUtf16Surrogate(value: string): boolean {
+	for (let index = 0; index < value.length; index += 1) {
+		const codeUnit = value.charCodeAt(index);
+		if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
+			if (index + 1 >= value.length || value.charCodeAt(index + 1) < 0xdc00 || value.charCodeAt(index + 1) > 0xdfff)
+				return true;
+			index += 1;
+		} else if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
+			return true;
+		}
+	}
+	return false;
+}
+
+function boundedLifecycleRequestId(requestId: unknown): string {
+	if (typeof requestId !== "string" || hasLoneUtf16Surrogate(requestId)) return "";
+	let bounded = "";
+	let byteLength = 0;
+	for (const codePoint of requestId) {
+		const codePointBytes = Buffer.byteLength(codePoint, "utf8");
+		if (byteLength + codePointBytes > MAX_LIFECYCLE_REQUEST_ID_BYTES) break;
+		bounded += codePoint;
+		byteLength += codePointBytes;
+	}
+	return bounded;
+}
+
+function lifecycleFailureResponse(requestId: unknown): SessionLifecycleResponse {
+	return {
+		type: "session_lifecycle_error",
+		requestId: boundedLifecycleRequestId(requestId),
+		status: "error",
+		reason: "terminal_uncertain",
+		message: "request could not be processed",
+	};
+}
+
+function recordLifecycleControlDiagnostic(): void {
+	try {
+		process.stderr.write("skc lifecycle control request failed\n");
+	} catch {
+		// Diagnostics must not suppress the fixed wire failure response or recovery.
+	}
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+function isSafeLifecycleId(value: unknown): value is string {
+	return typeof value === "string" && !hasLoneUtf16Surrogate(value);
+}
+
+/** The native server authenticates callbacks before redacting the control token. */
+type AuthenticatedNativeLifecycleRequest =
+	| Omit<SessionCreateFrame, "token">
+	| Omit<Extract<SessionLifecycleRequest, { type: "session_close" }>, "token">
+	| Omit<Extract<SessionLifecycleRequest, { type: "session_resume" }>, "token">;
+
+function isBoundedRequestFrame(frame: unknown): frame is AuthenticatedNativeLifecycleRequest {
+	if (
+		!isRecord(frame) ||
+		!isSafeLifecycleId(frame.requestId) ||
+		Buffer.byteLength(frame.requestId, "utf8") > MAX_LIFECYCLE_REQUEST_ID_BYTES
+	)
+		return false;
+	if (
+		!isSafeLifecycleId(frame.chatId) ||
+		(typeof frame.token !== "undefined" && typeof frame.token !== "string") ||
+		!Number.isSafeInteger(frame.updateId)
+	)
+		return false;
+	if (!isRecord(frame.target)) return false;
+	switch (frame.type) {
+		case "session_create":
+			return (
+				isSafeLifecycleId(frame.lifecycleRequestId) &&
+				isSafeLifecycleId(frame.intendedSessionId) &&
+				(typeof frame.startupPromptRef === "undefined" || typeof frame.startupPromptRef === "string") &&
+				(typeof frame.modelPreset === "undefined" || typeof frame.modelPreset === "string") &&
+				((frame.target.kind === "worktree" &&
+					typeof frame.target.repo === "string" &&
+					typeof frame.target.branch === "string") ||
+					((frame.target.kind === "existing_path" || frame.target.kind === "plain_dir") &&
+						typeof frame.target.path === "string"))
+			);
+		case "session_close":
+			return (
+				isSafeLifecycleId(frame.target.sessionId) &&
+				(typeof frame.target.tmuxSession === "undefined" || isSafeLifecycleId(frame.target.tmuxSession)) &&
+				(typeof frame.target.sessionStateFile === "undefined" ||
+					typeof frame.target.sessionStateFile === "string") &&
+				(typeof frame.force === "undefined" || typeof frame.force === "boolean")
+			);
+		case "session_resume":
+			return (
+				isSafeLifecycleId(frame.target.sessionIdOrPrefix) &&
+				(typeof frame.target.path === "undefined" || typeof frame.target.path === "string") &&
+				(typeof frame.startupPromptRef === "undefined" || typeof frame.startupPromptRef === "string")
+			);
+		default:
+			return false;
+	}
+}
+
 /**
  * Wire a control server's lifecycle requests through the orchestrator.
  *
@@ -356,21 +1191,39 @@ export function outcomeToResponse(frame: SessionLifecycleRequest, outcome: Lifec
 export function attachLifecycleControl(server: ControlServerLike, deps: OrchestratorDeps): void {
 	let queue: Promise<void> = Promise.resolve();
 	server.onLifecycleRequest((err, req) => {
-		if (err) return;
-		let frame: SessionLifecycleRequest;
-		try {
-			frame = JSON.parse(req.payloadJson) as SessionLifecycleRequest;
-		} catch {
+		if (err) {
+			recordLifecycleControlDiagnostic();
 			return;
 		}
-		queue = queue
-			.then(async () => {
-				const outcome = await handleLifecycleRequest(frame, deps);
-				server.respond(JSON.stringify(outcomeToResponse(frame, outcome)));
-			})
-			.catch(() => {
-				// A handler failure must not break the queue for later requests.
-			});
+		const envelopeRequestId = boundedLifecycleRequestId(req.requestId);
+		const run = async (): Promise<void> => {
+			let frame: AuthenticatedNativeLifecycleRequest | undefined;
+
+			try {
+				const parsed = JSON.parse(req.payloadJson) as unknown;
+				if (!isBoundedRequestFrame(parsed)) throw new Error("invalid lifecycle frame");
+				frame = parsed;
+				const outcome = await handleLifecycleRequest(frame as SessionLifecycleRequest, deps);
+
+				server.respond(
+					JSON.stringify(
+						outcome.status === "error" && outcome.reason === "terminal_uncertain"
+							? lifecycleFailureResponse(frame.requestId)
+							: outcomeToResponse(frame as SessionLifecycleRequest, outcome),
+					),
+				);
+			} catch {
+				recordLifecycleControlDiagnostic();
+				// A valid frame preserves its immutable request id; malformed frames use
+				// only the bounded native envelope id.
+				server.respond(JSON.stringify(lifecycleFailureResponse(frame?.requestId ?? envelopeRequestId)));
+			}
+		};
+		// Recover queue liveness only after this request has attempted its own
+		// failure response. A response transport failure cannot poison later work.
+		queue = queue.then(run, run).catch(() => {
+			recordLifecycleControlDiagnostic();
+		});
 	});
 }